Availability behavior

The OCI implementation maps the shared availability contracts to Distribution responses. Configuration selects availability.mode once during startup. none keeps reads and writes local and installs no distributed routes, workers, timers, metrics, or replica state. dc and ha add coordination and replication.

• A read-only replica refuses blob and manifest mutations with 503 Service Unavailable before protocol dispatch.
• A mutation under a superseded authority returns 503 Service Unavailable with code UNAVAILABLE. Retry it against the current writer.
• Blob and manifest retries converge by digest. A conflicting tag mutation remains a conflict.
• Mutable tag reads remain behind the readable frontier. Digest reads require verified bytes.
• Cross-datacenter placement tracks each manifest and referenced blob as separate content.

Availability mode does not change the Distribution protocol. It changes when a mutation succeeds.

Authority keys

An OCI authority is the repository path under the oci: scheme prefix. Repository library/nginx uses oci:library/nginx. The driver preserves distinct paths. The prefix separates OCI authority keys from keys owned by other registrations.

The first manifest publication assigns the repository home. Blob placement remains content-addressed and can span repositories and datacenters.

Finalization and retries

Blob membership, manifest publication, tag replacement, and delete operations fence against the committed repository epoch. A resumable upload retains its session and staged bytes after a stale-epoch refusal, so the client can retry finalization without sending the blob again. A monolithic upload retries its request.

The response omits leader, datacenter, and peer addresses. See Registry behavior for upload-state details.

Derived views

Hosted tag, manifest, and referrer reads remain behind the readable frontier while the required search view trails the metadata serial. A virtual repository also waits for hosted members. Cached repositories report upstream state and have no local hosted serial to gate.

Remote content and reclamation

A blob that misses local storage can use remote read-through from a verified peer placement.

The OCI reclamation inventory retains repository blob memberships plus each manifest's config, layers, and child content descriptors. Trash and verified placements add the shared references described in Blob reclamation.

Logging

Availability traces map manifest or repository publication to publish, deletion to delete, upstream content population to cache-fill, and metadata visibility changes to visibility. Content details stay out of the operation envelope event.

See client behavior across availability modes and logging for shared fields.